Kiota is an OpenAPI based HTTP Client code generator
Why It Matters
Analysis dossierWhy It Matters
Kiota is an OpenAPI based HTTP Client code generator. Versions prior to 1.29.1 and 1.31.1 are affected by a code-generation literal injection vulnerability in multiple writer sinks (for example: serialization/deserialization keys, path/query parameter mappings, URL template metadata, enum/property metadata, and default value emission). When malicious values from an OpenAPI description are emitted into generated source without context-appropriate escaping, an attacker can break out of string literals and inject additional code into generated clients. This issue is only practically exploitable when the OpenAPI description used for generation is from an untrusted source, or a normally trusted OpenAPI description has been compromised/tampered with. Only generating from trusted, integrity-protected API descriptions significantly reduces the risk. To remediate the issue, upgrade Kiota to 1.29.1, 1.31.1, or later and regenerate/refresh existing generated clients as a precaution. Refreshing generated clients ensures previously generated vulnerable code is replaced with hardened output.
High
Unknown
Unknown
Risk basis: Microsoft or Microsoft-managed product relevance; HIGH severity; Source severity; no confirmed exploitation signal
Affected Products & Remediation
1 source-backed product- microsoft kiota · < 1.31.1 · NVD CPE · Source
Vendor or catalog guidance (source)
Not provided by source
Known exploitation (source facts)
Only what a source states. Unknown means no source has said either way; it is not "not exploited".
- CISA KEV
- Unknown
- Exploited (source statement)
- Unknown
- Publicly disclosed (source)
- Unknown
Suggested hunting (rule-based inference)
SecOps Signal recommendation (rule-based inference). These steps are hunting hypotheses from the vulnerability class; they do not state or imply that exploitation occurred here or anywhere.
Matched local-access-review (CVSS AV:L, CVSS PR:L)
Exposure
- Identify hosts reporting this CVE, prioritising shared or multi-user systems.Telemetry: DeviceTvmSoftwareVulnerabilities · A local, low-privilege vector matters most where untrusted users can run code. · Rule local-access-review
Exploitation evidence
- Review source-stated impact and relevant application errors on affected hosts; local access alone does not establish privilege escalation.Telemetry: DeviceProcessEvents · The vector establishes local access and low privileges only. Confirm the impact from the advisory before choosing a specific hunt. · Rule local-access-review
Response
- Confirm the source-stated update on affected hosts.Telemetry: DeviceTvmSoftwareVulnerabilities · Host inventory can verify remediation. · Rule local-access-review
CISA KEV Record
CISA KEV status was not determined for this record.
Change History & Source Data
— No recorded material change
- CNA / source
- security-advisories@github.com
- Record status · verification
- UPDATED · NVD API
- CPE
- cpe:2.3:a:microsoft:kiota:*:*:*:*:*:*:*:*
Evidence & Provenance
Linked by the query's stored exact CVE association. Review required tables and validation status before use.
DeviceTvmSoftwareVulnerabilities| where CveId == "CVE-2026-41134"| project DeviceId, DeviceName, OSPlatform, OSVersion, SoftwareVendor, SoftwareName, SoftwareVersion, CveId, VulnerabilitySeverityLevel, RecommendedSecurityUpdate, RecommendedSecurityUpdateId| sort by VulnerabilitySeverityLevel descLooking up related community queries…